Digital forensics investigators are skilled professionals whose expertise is increasingly in demand beyond the realm of cybersecurity. Businesses are now turning to these meticulous sleuths for help with tasks such as document authentication in legal disputes and fraud cases. This shift can be attributed to the rise in data breaches and intellectual property thefts, making the involvement of cybersecurity experts in legal matters more common than ever before.
According to Aravind Swaminathan, a partner at Orrick, Herrington & Sutcliffe LLP, traditional investigators and attorneys may lack the necessary skills to navigate the intricacies of risk assessment and personally identifiable information. It is the unique ability of cybersecurity investigators to see beyond the surface of things that sets them apart from their traditional investigative counterparts.
In a recent example shared by J-Michael Roberts, a forensics expert at Law and Forensics, a seemingly routine eDiscovery analysis took a dramatic turn when the authenticity of a document came into question. Upon closer examination of the document’s metadata and a comprehensive analysis of the computer that created it, it was revealed that the document had been tampered with. Through a forensic search of the system, artifacts were uncovered showing that different parts of the document had been added at different times, ultimately exposing a fraudulent scheme.
“The case evolved from a simple contract dispute to a significant matter involving active fraud by one party against the other,” Roberts commented.
One of the key strengths of digital forensics investigators, as highlighted by Steven Hailey, an instructor at Edmonds College, is their ability to uncover evidence that can turn seemingly straightforward cases into serious criminal matters. In a dispute over a family business following the death of its owner, a forensics investigation revealed that certain documents had been falsified, casting doubt on their authenticity.
Hailey emphasized the importance of understanding the digital footprint left behind when data is manipulated or created, as it can provide invaluable insights into the true nature of the case at hand. This expertise often leads to the discovery of crucial data sets that would have otherwise gone unnoticed or deemed insignificant.
When it comes to helping corporate boards understand and respond to cybersecurity incidents, forensics experts play a vital role in guiding decision-making processes. Unlike a singular event like an airplane crash, cyberattacks are ongoing and require continuous management even after the initial breach is contained. CISOs conduct tabletop exercises to prepare boards for incident responses, as uncertainties and incomplete information often complicate the decision-making process.
Boards must recognize that an organization’s reputation hinges on its response to a breach, rather than the breach itself. Therefore, having a skilled incident response team in place, including forensic experts working closely with legal counsel, is essential to handling these situations effectively.
As Swaminathan aptly puts it, the challenge lies in accepting that not all incidents have clear-cut answers and that responses may not come swiftly. Boards must adapt to the evolving nature of cyber threats and rely on the expertise of forensic investigators to navigate these complex scenarios successfully.